Cyber Attack

What does a cyber attack look like to you the user?

Actions on recognising a cyber attack

Immediate actions

1. Observe what it is that you see on the screen – take a photo of the whole screen
2. If your device: Unplug the device – power and network. (Or do you leave on and monitor?)
3. If on-premise solution: Segregate the IT (unplug the network) to stop the proliferation
4. If software: Do not move or click any buttons (log off?)
5. Note what you are doing – visiting a website, looking at email, opening an attachment
6. Tell surrounding colleagues and report it to your supervisor
7. Don’t contact the perpetrator – they do not yet know about you
8. Don’t share any personal data or information
9. Report it to IT support or contact us.
10. Manage your unfolding crisis, we can offer assistance if needed

Secondary actions

1. Don’t pay the ransom
2. Continue not to share information
3. Change your password/s if you use the same password across platforms
4. Update your security questions, recovery questions, and restricted information
5. Contact relevant authorities, bank staff, taxation, government officials, social media companies
6. Items may be cancelled, so order new credit cards, bank cards, domain, email accounts, social media accounts, passport, phone number, etc.
7. Discuss the event with your IT support, and their next actions
8. Assess the damage and identify the extent of the attack
9. Prepare secondary means or devices for use and access to your information, e.g. if your PC is infected use your phone for email
10. Remediate your IT, run scans, restore from backups, rebuild IT
11. Update your team and affected stakeholders

Tertiary actions

1. Investigate the how and why of the attack
2. Put in place remediation steps and stronger defences
3. Consider improved security – complex passwords, multifactor authentication
4. Document: detail the how, why, where and when
5. Report to Police or Government officials
6. Consider cybersecurity insurance
7. Notify the OAIC if you need to comply with mandatory reporting and notifiable data breach after a cyberattack
8. Undertake further education
9. Improve your responses with IT support and third-party providers
10. Revise your cybersecurity plan and responses

To mitigate a cyber attack

1. Consider alternative device use (laptop, smartphone, personal computer, Cloud services, etc.) – don’t put all your eggs in one basket
2. Consider a range of preventative measures – complex passwords, antivirus software, mail scanning, two-factor authentications, a layered defence
3. Implement a backup to allow the remediation after an attack; keep software authorisation codes separate for a restore – mitigation steps
4. Consider multiple means to access your data or accounts, e.g. phone banking, web-based bank access
5. Implement a range of layered passwords and access strategies rated at:
   • Simple (non-sensitive, not important, e.g. an online book reader)
   • Medium (personal data but not financial, e.g. social media account)
   • Complex (online purchases that contain credit card information, e.g. Amazon)
   • Highly complex (financial data and significant personal data, e.g. smartwatch)
   • Ultimate (close personal significant finances and data that often involve two-factor authentication – banking, taxation office, share trading, etc.)
6. Keep yourself private – don’t become the target
7. There is a relationship with security and cost – free can be insecure; pay to be secure. Ease of use can also indicate lesser security (Facebook, Gmail, LinkedIn, etc.)
8. Mange your exposure – update software, apply patches, update devices, regularly review accounts, apply the direction from your authorities
9. Set up a relationship to consult or work with a security professional or IT support
10. Be naturally suspicious of people or activities that you do not know or trust.

Passwords

To mitigate data spills and breaches and other cyber security incidents, the ACSC advises the following:

• require all users to periodically reset passwords to reduce the ongoing risk of credential compromises
• consider increasing password length and complexity requirements to mitigate the risk of brute-force attacks being successful
• implement a lockout for multiple failed login attempts
• if credentials have been compromised, reset passwords as soon as possible
• discourage users from reusing the same password across critical services such as banking and social media sites, or sharing passwords for a critical service with a non-critical service
• recommend the use of passphrases that are not based on simple dictionary words or a combination of personal information: this reduces the risk of password guessing and simple brute-forcing
• advise users to ensure new passwords do not follow a recognisable pattern: this reduces the risk of intelligent brute-forcing based on previously stolen credentials

Software Systems

To mitigate data spills and breaches and other cyber security incidents, the ACSC advises the following:

• use multi-factor authentication for all remote access to business systems and for all users when they perform a privileged action or access an important (sensitive/high-availability) data repository
• look out for unusual account activity or suspicious logins: this may help detect when a service such as email has been compromised and needs a password reset
• encourage users to think carefully before entering credentials:
  • ask if this is normal
  • don’t enter credentials into a form loaded from a link sent in email, chat or other means open to receiving communications from an unknown party
  • even if the page looks like the service being reset, think twice
  • do not click the link; instead, browse to the website and reset the password from there
  • be aware that friends or other contacts’ accounts could be compromised and controlled by a third party to also send a link
• keep operating systems, browsers and plugins up-to-date with patches and fixes
• enable anti-virus protections to help guard against malware that steals credentials